Tag: Credential Protection

Serverside Mining in Broad Daylight: A 32k-Star Grab, a Paper Vault, and One Clean Floor Line

dsh-our-free-model — 32.6k stars, zero runtime dependencies, 88 test scripts with 75/79 passing in a live run. Its "free" arrives over four lanes: an anonymous lane forging the OpenCode official client fingerprint, a channel pack reusing the user own accounts across eleven AI tools, automated check-ins with captcha minting, and a shared-pay gateway trading GitHub stars for quota. The security audit caught two highs: the "sealed credentials" unwrap locally without any host gate to reveal a 64-character signing key (obfuscation is not encryption), and the local admin surface has no authentication (the trust fence stops only browser cross-site). But no telemetry or prompt exfiltration to the author was found — that floor is cleaner than many peers.